puppet-vault

Puppet module to install and run Hashicorp Vault.

Currently installs v0.3.1 Linux AMD64 binary.

Support

This module is currently only tested on Ubuntu 14.04.

Usage

include vault

By default, vault requires a minimal configuration including a backend and a listener.

class { '::vault':
    config_hash => {
        'backend' => {
            'file' => {
                'path' => '/tmp',
            }
        },
            'listener' => {
                'tcp' => {
                    'address' => '127.0.0.1:8200',
                    'tls_disable' => 1,
                }
            }
    }
}

or alternatively using Hiera:

---
vault::config_hash:
    backend:
        file:
            path: /tmp
    listener:
        tcp:
            address: 127.0.0.1:8200
            tls_disable: 1

mlock

By default vault will use the mlock system call, therefore the executable will need the corresponding capability.

The module will use setcap on the vault binary to enable this. If you do not wish to use mlock, then modify your config_hash like:

class { '::vault':
    config_hash => {
        'disable_mlock' => true
    }
}